Riskcovery

CVE-2025-71147

KEYS: trusted: Fix a memory leak in tpm2_load_cmd

State
Published
Severity
Not scored
Published
Jan 23, 2026
Updated
Oct 19, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix a memory leak in tpm2_load_cmd

'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping the blob into with a cleanup helper.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • f2219745250f388edacabe6cca73654131c67d0a to before 3fd7df4636d8fd5e3592371967a5941204368936Affected
  • f2219745250f388edacabe6cca73654131c67d0a to before af0689cafb127a8d1af78cc8b72585c9b2a19ecdAffected
  • f2219745250f388edacabe6cca73654131c67d0a to before 19166de9737218b77122c41a5730ac87025e089fAffected
  • f2219745250f388edacabe6cca73654131c67d0a to before 9b015f2918b95bdde2ca9cefa10ef02b138aae1eAffected
  • f2219745250f388edacabe6cca73654131c67d0a to before 9e7c63c69f57b1db1a8a1542359a6167ff8fcef1Affected
  • f2219745250f388edacabe6cca73654131c67d0a to before 62cd5d480b9762ce70d720a81fa5b373052ae05fAffected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 5.15.198 through 5.15.*Not affected
  • 6.1.160 through 6.1.*Not affected
  • 6.6.120 through 6.6.*Not affected
  • 6.12.64 through 6.12.*Not affected
  • 6.18.3 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.